Has anyone ever used Saloon to invoke an AWS Lambda function url?

[maxwoerner]

Hi guys,

has anyone ever used the awesome Saloon package to invoke an AWS Lambda function url?

AWS requires all requests to be signed with their AWS signing protocol (Signature Version 4). I've currently implemented this using the AWS SDK for PHP.

Going forward I would like to leverage Saloon to do the same and I was wondering if anyone has every got that working? I guess the challenge would be to somehow sign the Saloon request but I can't really find a starting point.

This is my current solution without Saloon:

$client = new Client();
$headers = ['Content-Type' => 'application/json', 'User-Agent' => 'null'];

$request = new Request('POST', config('aws.lambda_function_url'), $headers, $body);

$credentials = new Credentials(config('aws.lambda_access_key_id'), config('aws.lambda_secret_access_key'));
$s4 = new SignatureV4('lambda', config('aws.default_region'));

$signedRequest = $s4->signRequest($request, $credentials);

$response = $client->sendAsync($signedRequest)->wait();

Would be great if anyone would have an example for a Saloon implementation or point me in the right direction...

[maxwoerner]

I got it working by "cloning" the headers from the signed Guzzle request using the AWS SDK. Not the cleanest solution, but it's working.

Here's my defaultHeaders() method:

protected function defaultHeaders(): array
{
    $headers = ['Content-Type' => 'application/json'];

    $request = new \GuzzleHttp\Psr7\Request('POST', config('aws.lambda_function_url'), $headers, $this->payload);

    $credentials = new \Aws\Credentials\Credentials(config('aws.lambda_access_key_id'), config('aws.lambda_secret_access_key'));
    $s4 = new \Aws\Signature\SignatureV4('lambda', config('aws.default_region'));

    $signedRequest = $s4->signRequest($request, $credentials);

    return $signedRequest->getHeaders();
}

[Sammyjo20]

Hey @maxwoerner nice work finding a solution, it would be interesting to see inside of the “signRequest” method - I wonder if AWS is just applying a couple of headers that you could replicate.

From v3 and onwards, saloon will use PSR-7 requests and there will be a hook available on the connector and request to do something with the request. That is where you could sign the request in the future.

[maxwoerner]

As far as I understand, it generates a couple of hashes from credentials, body, etc. and then applies these signatures to the header of the request. This is the signRequest() method: SignatureV4

It could be done manually as well. There's a pretty detailed AWS documentation of how its done: Create a signed AWS API request

Sounds like the v3 Feature is exactly what is needed here.

Thanks for creating this awesome package!

[ejntaylor]

I think with v3 we can now create a middlware and then use the boot() method to apply it in the connector.

Here is a middleware I created for this as an example: https://gist.github.com/ejntaylor/83230fa3a0f68ac8806c562590add146

Not 100% sure on my middleware as signRequest() method as the expected parameter is '\Psr\Http\Message\RequestInterface' but '\Saloon\Http\Request' provided

Will aim to update here once I get working fully.

[Sammyjo20]

Hey @ejntaylor Thanks for sharing this - it's super useful! Nice one on building a separate middleware class. To get it working you have to instantiate the invokable class like this:

$pendingRequest->middleware()->onRequest(new SignAwsRequest);